CVE-2025-13160: IQ-Support Information Disclosure Flaw

CVE-2025-13160 Overview

CVE-2025-13160 is an Exposure of Sensitive Information vulnerability [CWE-497] affecting IQ-Support, developed by IQ Service International. The flaw allows unauthenticated remote attackers to reach specific application programming interfaces (APIs) and retrieve sensitive information from the internal network. Exploitation requires no authentication, no user interaction, and can be performed across the network. The vulnerability was disclosed through the Taiwan Computer Emergency Response Team (TW-CERT) in security advisories 10501 and 10502.

Critical Impact
Unauthenticated remote attackers can query exposed APIs to harvest sensitive internal network information without any prior access or user interaction.

Affected Products

IQ-Support (developed by IQ Service International)
Specific affected versions were not enumerated in the NVD record
Refer to TW-CERT advisories 10501 and 10502 for version guidance

Discovery Timeline

2025-11-14 - CVE-2025-13160 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13160

Vulnerability Analysis

The vulnerability is categorized under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. IQ-Support exposes one or more API endpoints that return internal network data without requiring authentication. An attacker sending crafted HTTP requests to these endpoints can enumerate internal information that should remain restricted to authorized administrators.

The attack vector is Network, attack complexity is Low, and no privileges or user interaction are required. Confidentiality is impacted, while integrity and availability are unaffected. The Exploit Prediction Scoring System (EPSS) rates the probability of exploitation at 0.303%, indicating limited but non-trivial interest in the flaw.

Because the exposed APIs reveal internal-network details, the vulnerability functions as a reconnaissance primitive. Adversaries can chain the disclosed information with follow-on attacks against internal services that would otherwise be shielded from external discovery.

Root Cause

The root cause is missing authentication and authorization enforcement on specific IQ-Support API endpoints. The affected APIs return data referencing internal network resources without validating the caller's identity or session context. This results in sensitive system information being exposed to an unauthorized control sphere.

Attack Vector

An unauthenticated remote attacker sends HTTP requests directly to the vulnerable API endpoints of an internet-reachable IQ-Support deployment. The server processes the requests and returns internal-network information in the response body. No exploit code, malware, or user interaction is required. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. See the TW-CERT Security Advisory 10502 and TW-CERT Security Advisory 10501 for technical details.

Detection Methods for CVE-2025-13160

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to IQ-Support API endpoints originating from external or untrusted source addresses
Repeated API enumeration patterns targeting IQ-Support installations, particularly bursts of sequential endpoint probing
API responses containing internal hostnames, IP ranges, or system metadata returned to external clients

Detection Strategies

Review web server and reverse proxy access logs for requests to IQ-Support API paths that lack authentication headers or session cookies
Compare API request source addresses against expected administrative networks and flag deviations
Deploy web application firewall (WAF) rules that alert on anonymous access to IQ-Support API endpoints returning internal-network data

Monitoring Recommendations

Enable verbose access logging on all IQ-Support API endpoints with source IP, user agent, and response size fields
Monitor egress payload sizes for anomalous responses that indicate bulk information disclosure
Alert on API calls arriving from geographies or autonomous systems that do not match legitimate administrative usage

How to Mitigate CVE-2025-13160

Immediate Actions Required

Restrict external network access to IQ-Support management and API endpoints using firewall rules or reverse proxy allowlists
Contact IQ Service International and consult the TW-CERT advisories to obtain remediation guidance for your deployed version
Audit access logs for prior unauthenticated requests to API endpoints and treat any exposed data as compromised

Patch Information

Vendor patch details are published through TW-CERT. Administrators should consult the TW-CERT Security Advisory 10502 and TW-CERT Security Advisory 10501 for the fixed version and upgrade instructions from IQ Service International.

Workarounds

Place IQ-Support behind a VPN or zero-trust network access gateway so API endpoints are not reachable from the public internet
Enforce authentication at the reverse proxy or WAF layer for all API paths until the vendor patch is applied
Segment IQ-Support servers from sensitive internal networks to limit the scope of information available through the vulnerable APIs

bash

# Example nginx configuration restricting IQ-Support API access to internal networks
location /api/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://iq-support-backend;
}